Product:
Adobe Flash Player
Summary
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. This vulnerability was actively exploited in the wild in May 2016, posing significant risks to users.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2016-4117 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious file or webpage that, when accessed by a user with the vulnerable version of Adobe Flash Player, triggers the execution of arbitrary code. This can lead to unauthorized access to the system, allowing the attacker to take control and execute further malicious actions.
Affected Products
- Adobe Flash Player 21.0.0.226 and earlier: Vulnerable to remote code execution through unspecified vectors.
Mitigation
The impacted product is end-of-life and should be disconnected if still in use. Users are strongly advised to upgrade to a supported version or remove the software entirely to mitigate risks associated with this vulnerability.
References
- OpenSUSE Security Announcement 1
- OpenSUSE Security Announcement 2
- OpenSUSE Security Announcement 3
- OpenSUSE Security Announcement 4
- Red Hat Security Advisory
- SecurityFocus BID 90505
- SecurityTracker ID 1035826
- Adobe Security Advisory APSA16-02
- Adobe Security Bulletin APSB16-15
- Gentoo GLSA 201606-08
- Exploit-DB Exploit 46339
- CISA Known Exploited Vulnerabilities Catalog